5 ms·
Dissecting PostgreSQL CVE-2013-1899
- agwa 14y agoNice article. > Now we have to wait for an administrator to “su – postgres”. Likely? Eh. This isn't that unlikely. On Debian/Ubuntu, postgres is the database super user and doesn't have a password set by default so the way to administer PostgreSQL is to su to postgres and then run psql/createdb/etc (it relies on local ident authentication).
- jaytaylor 14y agoVery creative. And scary! The shell script could download and run any binary. Would be neat if there were an exploit which injected something to make further injection impossible.
- ibotty 14y agoehm. anti-virus? there's a whole discussion about it, i won't go into here. but what can an anti-virus do? best would be to patch the database (might be pretty hard). then it could write something like: echo "you have been hacked!"; exit 0 into the .profile. that will let the user spot the cracking attempt.
- mpowered 14y agoWhat....are you talking about
- achillean 14y agoThe latest data from Shodan shows that there are at least 10,610 vulnerable systems (189,680 public PostgreSQL database instances were tested).